Description
In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < 260925a0b7d2da5449f8ecfd02c1405e0c8a45b8affected39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < bbc6847b9b8978b520f62fbc7c68c54ef0f8d282affected39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < 92668d28c7e6a7a2ba07df287669ffcdf650c421affected39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < 08ab951787098ae0b6c0364aeea7a8138226f234affected39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < ac48ef15826e83f4206c47add61072e8fc76d328affected39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < 593c072b7b3c4d7044416eb039d9ad706bedd67aaffected39549eef3587f1c1e8c65c88a2400d10fd30ea17 to < 03f16c5075b22c8902d2af739969e878b0879c94affected
Linux Linux
Default version status: affected
2.6.31affected0 to < 2.6.31unaffected4.4.254 to ≤ 4.4.*unaffected4.9.254 to ≤ 4.9.*unaffected4.14.218 to ≤ 4.14.*unaffected4.19.171 to ≤ 4.19.*unaffected5.4.93 to ≤ 5.4.*unaffected5.10.11 to ≤ 5.10.*unaffected5.11 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/260925a0b7d2da5449f8ecfd02c1405e0c8a45b8 ↗
- https://git.kernel.org/stable/c/bbc6847b9b8978b520f62fbc7c68c54ef0f8d282 ↗
- https://git.kernel.org/stable/c/92668d28c7e6a7a2ba07df287669ffcdf650c421 ↗
- https://git.kernel.org/stable/c/08ab951787098ae0b6c0364aeea7a8138226f234 ↗
- https://git.kernel.org/stable/c/ac48ef15826e83f4206c47add61072e8fc76d328 ↗
- https://git.kernel.org/stable/c/593c072b7b3c4d7044416eb039d9ad706bedd67a ↗
- https://git.kernel.org/stable/c/03f16c5075b22c8902d2af739969e878b0879c94 ↗